I am trying to find a way to obtain the real ip addresse(s) for a domain name. I'm working on a router doing traffic shaping with the use of iptables and tc. I then need to setup iptables rules for marking packets coming from certain domains, using their ip addresses.

In a first time I used the dig command, querying the name server of the domain, like this:

nbNameServer=`$dig NS $url +short | wc -l`

# If there is NS for the given domain
if [ $nbNameServer -gt 0 ]; then

for i in $($dig NS $url +short $TOdig); do

    ipDom=`$dig @$i $url +short $TOdig`

    # Ip found on the $i name server, no need to consult the others
    if [ -n "$ipDom" ]; then
        failed=`echo -e "$ipDom" | egrep "no servers could be reached"`

         if [ ! -n "$failed" ]; then

If the router in the /etc/resolv.conf file has let's say google DNS, is there a way one of the ip or domain is not up to date or spoofed using the way I did ?

I actually don't know if the router will be in an environment where a local DNS server is used or not.

Is it possible to perform a secure DNS lookup with the host command too ?

The only thing I want to be sure is that for a given domain mydomain.com, the DNS lookup will return all the ip addresses (I just need the A or AAAA record), up to date.

I am still a little confused about all the DNS mechanisms, so any comments/remarks/advices are of course welcomed.

3 Answers 3


Practically speaking, it's highly unlikely that the results you obtain from dig will have been falsified. If you want some sort of absolute assurance, though, you're out of luck -- without something like DNSSEC, spoofing is entirely possible.

  • Ok, so as long as I query the domain for its eventual name server and then do the ip lookup for the domain specifying the name server, it's the best I can do to ensure the authenticity of the ip addresses ?
    – Mulot
    Commented Jan 1, 2010 at 5:47
  • 1
    I wouldn't even bother with that. If some requests are going to be spoofed, you can't guarantee that any of them are correct. Just use dig as per normal and move on with more interesting things.
    – womble
    Commented Jan 1, 2010 at 6:31

As long as DNSSEC isn't widely used, the best way to protect against DNS spoofing is to use "source port randomization". This is especially important since the "Kaminsky DNS bug".

You need to make sure that both the version of DIG that you use as well as the recursive DNS server that you query have implemented "source port randomization".

Theoretically it is still possible to spoof even "source port randomization", but it would take a LONG time and a LOT of network traffic.


So, if you do a dig +dnssec and look for 'ad' in the flags field, you know it wasn't spoofed... but since dnssec is not enabled for very many zones, that isn't going to tell you anything in most cases.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .